Techibee.com

Would it not be helpful if all scripts are at one place and you can navigate/browse them through single window?
Microsoft team is working on a tool called Script Explorer for Windows Powershell.

Go through below link for more details.

http://blogs.technet.com/b/exchange/archive/2012/03/14/check-out-microsoft-script-explorer-for-windows-powershell-pre-release.aspx

I came across a situation today where I had to find out the switch details to which a particular server is connected. Often we come across such kind of cases where your network administrator is unavailable to tell you which switch/port it is or data center engineer not around to help you with this information.

After thinking about this problem for sometime, one thing clicked in my mind. I remember in VMWare ESX environment, I used CDP(Cisco Discovery protocol) abilities from Virtual center to find out to which switch a NIC is connected. That means all I need to do is, get this CDP information from the switch to which my server NIC/network connection is connected to. So, the question remained is, how do we send the CDP request to the switch, and how to analyze that data.

I did some googling and realized that I am not alone in this world and there are several people who are having similar requirements for different purposes. Then I started looking for CDP utilities for windows operating system and located one — CDP Monitor from TellSoft. I have seen a few people recommended using this in some forums. I didn’t try it personally but you may want to look at this tool. You can get it from http://www.tallsoft.com/cdpmonitor.htm

I didn’t try this tool directly but while going through the information about this tool, I saw somewhere it is mentioned that this uses WinPCAP and fetches the CDP information from that. Then I thought, if it is using WinPCAP why not use Wireshark to get this information? This tool is already available on my server(because it is a much have tool for any deep dives). I captured the network traffic on the server for sometime using Wireshark and looked for the filters that can show only the CDP information and I am successful. I have got the switch details I needed.

Below is the brief procedure:

1. Download and install Wireshark from http://www.wireshark.org/download.html
2. Launch Wireshark and start capturing the traffic on interface for which you need to find the swtich and port details.
3. Let the capture run for few minutes and then in Filter section type CDP and click on Apply.
4. This will show the CDP traffic flow through the server
5. Now select the CDP traffic and expand Cisco Discovery Protocol section in packet details pane.
6. Here the the Device ID represents the switch name to which your server connected
7. And the Port ID represents the ethernet port on switch to which your server is connected

Hmm… I found what I need. I thought documenting this will help other as well and hence authored this port. Feel free to comment.

If you are in INDIA and cannot attend TechEd 2012 for some commute or any different reasons, there is an opportunity for you to attend all TechEd sessions from your desk itself. Microsoft has made TechEd India 2010 online to busy admins and tech enthusiasts. All you need to do is visit below link and register yourself.

https://india.msteched.com/TechEdLive

You can follow all TechEd India 2012 sessions include keynotes, demos, etc.

If you find any session interesting for System administrators, then please do share the details in comments sections so that others can follow it.

Hope this helps…

Hi Readers,

Before signing out today, I wanna share a quick tip that you can use in windows 7 or windows 2008 computers to open any program with administrator account. That means elevating a applications. You might want to ask, isn’t it easy to right click and say “Run As Administrator”?. Well, that option you won’t get for all applications. Give a try with Office applications if you want to observe this. In such cases, one need to open a elevated command prompt and launch the application from there which is somewhat time consuming. Instead you can use the below tip.

Hold Ctrl + Shift and then click on the application. It will automatically try to open in elevated mode.

Hope this helps and happy learning.

Recently I came across a forum question where I have seen people using Win32_Product WMI class to get the installed installed applications list from remote computers. Historically, Win32_Product proved to be a buggy one due to various factors (which I will talk in later posts). So, I didn’t recommend them to use Win32_Product WMI class. If not WMI, what are the various options available to get the installed problems from remote computers. There are two methods (1) Using Win32Reg_AddRemovePrograms (2) Using Registry(uninstallkey).

The Win32Reg_AddRemovePrograms is not a common WMI class that you will find in any windows computer. It comes along with SMS or SCCM agent installation. So if you have one of these agents then probably you can explore this method. Otherwise, we need to rely on registry to get this information. Is the information queried from registry is accurate? My answer is YES and NO. It gives all the applications installed by both MSI installer and executables. But some of the registry keys will have less information about the software — not sure why it is that way.

Keeping the downsides aside, it is definitely the best approach to get installed softwares from remote computer. I am also excluding the applications from display if their display name black(which makes sense). This script will return the uninstall string as well which is essential for uninstalling the software. I will use this in my upcoming posts to uninstall a software remotely.

Now Code follows.

[cmdletbinding()]            

[cmdletbinding()]
param(
 [parameter(ValueFromPipeline=$true,ValueFromPipelineByPropertyName=$true)]
 [string[]]$ComputerName = $env:computername            

)            

begin {
 $UninstallRegKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall"
}            

process {
 foreach($Computer in $ComputerName) {
  Write-Verbose "Working on $Computer"
  if(Test-Connection -ComputerName $Computer -Count 1 -ea 0) {
   $HKLM   = [microsoft.win32.registrykey]::OpenRemoteBaseKey('LocalMachine',$computer)
   $UninstallRef  = $HKLM.OpenSubKey($UninstallRegKey)
   $Applications = $UninstallRef.GetSubKeyNames()            

   foreach ($App in $Applications) {
    $AppRegistryKey  = $UninstallRegKey + "\\" + $App
    $AppDetails   = $HKLM.OpenSubKey($AppRegistryKey)
    $AppGUID   = $App
    $AppDisplayName  = $($AppDetails.GetValue("DisplayName"))
    $AppVersion   = $($AppDetails.GetValue("DisplayVersion"))
    $AppPublisher  = $($AppDetails.GetValue("Publisher"))
    $AppInstalledDate = $($AppDetails.GetValue("InstallDate"))
    $AppUninstall  = $($AppDetails.GetValue("UninstallString"))
    if(!$AppDisplayName) { continue }
    $OutputObj = New-Object -TypeName PSobject
    $OutputObj | Add-Member -MemberType NoteProperty -Name ComputerName -Value $Computer.ToUpper()
    $OutputObj | Add-Member -MemberType NoteProperty -Name AppName -Value $AppDisplayName
    $OutputObj | Add-Member -MemberType NoteProperty -Name AppVersion -Value $AppVersion
    $OutputObj | Add-Member -MemberType NoteProperty -Name AppVendor -Value $AppPublisher
    $OutputObj | Add-Member -MemberType NoteProperty -Name InstalledDate -Value $AppInstalledDate
    $OutputObj | Add-Member -MemberType NoteProperty -Name UninstallKey -Value $AppUninstall
    $OutputObj | Add-Member -MemberType NoteProperty -Name AppGUID -Value $AppGUID
    $OutputObj# | Select ComputerName, DriveName
   }
  }
 }
}            

end {}

Copy this code to a text file and save it as Get-InstalledSoftware.ps1. Look at the below image for usage.

You might get alerts your DFS-R management pack in SCOM about the DFS-R service inability to register itself with WMI and it can impact the replication. Exact error message is given below.

DFS Replication failed to register itself with WMI. Replication is disabled until WMI registration succeeds.

To resolve this issue, you may need to re-register DFS-R related DLL and other files that belongs to WMI. Before going there, just restart your DFS-R service once to confirm that your problem is not transient and happening all time. You will notice a error message with 6104 event ID in DFS Replication event log after you restart the service. If this event is present, then problem is live and you should fix it.

The following solution worked for me.

CD %windir%\system32\wbem

mofcomp dfsrprov.mof

mofcomp dfsrprov.mfl

wmiprvse /regserver

net stop dfsr

net start dfsr

All it does is re-register the WMI related files of DFS-R.

If you still notice issues, you may want to re-register everything under WBEM folder. This was suggested in Technet Forum.

CD %windir%\system32\wbem
For /f %s in (‘dir /b /s *.dll’) do regsvr32 /s %s
for /f %s in (‘dir /b *.mof *.mfl’) do mofcomp %s
wmiprvse /regserver
net stop dfsr
net start dfsr

if the problem is still not resolved, try rebooting the DFS-R server.

Sometimes, the compilation of MOF files might fail with below errors while performing above steps. In such cases, http://support.microsoft.com/kb/841619 might help you.

C:\WINNT\system32\wbem>mofcomp dfsrprov.mof
Microsoft (R) 32-bit MOF Compiler Version 5.2.3790.3959
Copyright (c) Microsoft Corp. 1997-2001. All rights reserved.
Parsing MOF file: dfsrprov.mof
MOF file has been successfully parsed
Storing data in the repository…
An error occurred while opening the namespace for object 1 defined on lines 4 -
4:
Error Number: 0x8007000e, Facility: Win32
Description: Not enough storage is available to complete this operation.
Compiler returned error 0x8007000e

A few more reference that might be useful for troubleshooting the issue:

1. DFSR Does Not Replicate Temporary Files : http://blogs.technet.com/b/askds/archive/2008/11/11/dfsr-does-not-replicate-temporary-files.aspx
2. http://social.technet.microsoft.com/Forums/en-US/winserverfiles/thread/b8a8f0e6-9fcb-4a98-9951-bce109927dc8/

Thanks for reading my rambling. I wrote this for my quick reference and to help people who is searching for similar information.

WARNING: Above steps involves re-registration of WMI providers. So, test them in your lab and try in production at your own risk. I am not responsible for any damage that caused by above procedure.

Hope this helps…

Hello Readers,
How many of you regularly use twitter? I guess most of you. Have ever worried about the security it is providing? You should read on if your answer is NO.

One of colleagues gave a quick demo a few days back to show how insecure the default twitter is. His demo proved that, any one sitting in same network as yours can easily hijack your twitter account and tweet on behalf of you. He was able to make it because twitter runs on http by default. Since it is http, all the data transfer will happen over wire in plain text format. So, any one in your network with a couple of  tools can spoof your MAC address can easily capture what you are sending over wire and get the twitter cookie(key for maintaining your twitter session) and tweet using your twitter account. The method that my colleague demonstrated is a simple hack any one with computer knowledge can execute it.

How to I make it secure:  Twitter provides a option to make your twitter account to use https(secure http) as default protocol. Making use of this will at least prevent your twitter account from this kind of silly hacks.

You can follow the below procedure to enable the https

• Logon to twitter account.
• Go to your profile tab and click on edit profile
• Go to Account section in your profile and check the box Always use HTTPS
• Click on Save and enter your password when prompted

• Now your twitter account is secured.

Do you like one liners in powershell? Here is the quick and easy way to start, stop, restart a service on remote computer. This doesn’t require PowerShell remoting. That means you can use it against any computer which has windows operating system installed.

So far I have authored two articles on managing services using powershell:

1. Start/Stop/Restart service on remote computer with powershell
2. PowerShell: Start and stop services on remote computer with alternate credentials

The first one I wrote when I was not matured enough with PowerShell and the second one recently to address a specific requirement where user need to pass alternate credentials to manage services.

As most system administrators love to use poweshell one-liners which avoids any external script/module invocation, I want to share this little one which starts, stops, and restarts a service on remote computer.

Start a service on remote computer:

Start-Service -InputObject $(Get-Service -Computer COMPUTER1 -Name spooler)

Stop a service on remote computer:

Stop-Service -InputObject $(Get-Service -Computer COMPUTER1 -Name spooler)

Restart a service on remote computer:

Restart-Service -InputObject $(Get-Service -Computer COMPUTER1 -Name spooler)

Hope these little ones helps.

The popularity of PowerShell is increasing day-to-day and now every System administrator want to say bye to their VB scripts and enter the powerful powershell world. A system administrator who is familiar with VB script(or has in home grown scripts in VB) want to try powershell, the first question he gets into mind is, “how to do xyz task in powershell”. Of course, we can ask our big brother google.com but it will take little long to find the powershell way of coding a task.

For those kind of admins, MS has published a long list of converting xyz from VB script to PowerShell. This pretty much enough for a person who wants to convert their VB scripts into powershell code. For your easy reference I am posting the content from MS technet site to here.

Hope this helps…

You might see the error message outlined in subject while installing/uninstalling software on windows 2003 computer by connecting to terminal services. We all know that application installation has certain limitations when it comes to terminal services (anyone know why?). In such cases if you still want to install/uninstall the application on these terminal services enabled servers, you need to choose one of the following methods.

If this the requirement is just one of the case, then option#1 best suits you.

Option#1:

start mstsc with /console or /admin option and then connect to the server. This allows you to connect to the console of the server directly eliminating terminal services piece from you way.

Go to start -> Run -> type “mstsc /admin /v:servername” and click OK if you are using RDP client v6 or above

Go to start ->Run -> type “mstsc /console /v:servername” and click OK if you are using legacy version of RDP client.

Option#2:

If your administrators are expected to install applications on servers by connecting via terminal services, then you need to make sure that application installation is allowed. You can do it via group policies.

“computer configuration” -> “administrative templates” -> “windows components” -> “windows installer” -> “allow admin to install from terminal server session” should be enabled

Hope this helps.